Executive brief
Highcharts is a widely-used JavaScript charting library used to create interactive graphs and visualizations in web applications. Versions before 6.1.0 contain a regular expression parsing flaw that allows untrusted input to cause excessive processing, rendering the application unresponsive and disrupting service availability for users.
Technical details
This vulnerability is a Regular Expression Denial of Service (ReDoS) affecting the SVGRenderer text processing component in Highcharts. Untrusted input passed to text rendering functions can trigger catastrophic backtracking in poorly-designed regular expressions used to parse and replace attributes such as class, href, and style. The attack requires only network reachability with no authentication needed, and exploiting it causes the application to consume excessive CPU and become unresponsive. The vulnerability was patched in version 6.1.0 by refactoring the regex patterns to avoid backtracking-prone constructs.
Affected products
- Highcharts Highcharts < 6.1.0
Timeline
- 2019-03-18: disclosed
- 2018-03-01: patched: Fix commit authored, patch released in version 6.1.0